Steel Box 脱壳-加壳脱壳-看雪-安全社区|安全招聘|kanxue.com

Steel Box 脱壳

发表于: 2004-12-13 08:32 8400

Steel Box 脱壳

csjwaman

2004-12-13 08:32

8400

这个壳总算搞定了。但我的方法也许并不好，fly兄弟有更好的办法，可以在到达入口前完成脱壳，所以还是等fly兄弟的脱文出来。我的脱文只不过是提供一下思路。请大侠们指教。

一、找入口

用OD载入，隐藏OD，bp GetWindowTextAF9，运行，随便输入验证码，断下后返回，一直到：

02CC5164 E8 3A690000    CALL 02CCBAA3
02CC5169 8B85 68FFFFFF MOV EAX,DWORD PTR SS:[EBP-98]
02CC516F E8 84440000    CALL 02CC95F8
02CC5174 8D9D 60FEFFFF LEA EBX,DWORD PTR SS:[EBP-1A0]
02CC517A B9 00010000    MOV ECX,100
02CC517F E8 65690000    CALL 02CCBAE9
02CC5184 FFB5 50FEFFFF PUSH DWORD PTR SS:[EBP-1B0]////注册码
02CC518A 8B55 80       MOV EDX,DWORD PTR SS:[EBP-80]////验证码
02CC518D E8 4C660000    CALL 02CCB7DE////比较
02CC5192 0F85 0B000000 JNZ 02CC51A3////不能跳。
02CC5198 C7C7 40D91202 MOV EDI,212D940
02CC519E E9 06000000    JMP 02CC51A9
02CC51A3 C7C7 9B38CA01 MOV EDI,1CA389B
02CC51A9 DD85 48FEFFFF FLD QWORD PTR SS:[EBP-1B8]
02CC51AF E8 9E620000    CALL 02CCB452
02CC51B4 DEE1          FSUBRP ST(1),ST
02CC51B6 DE1D 44D5CC02 FICOMP WORD PTR DS:[2CCD544]
02CC51BC DFE0          FSTSW AX
02CC51BE 9E             SAHF
02CC51BF 0F86 30000000 JBE 02CC51F5////必须跳!
02CC51C5 C7C7 46DD0B00 MOV EDI,0BDD46
02CC51CB 8D9D 60FEFFFF LEA EBX,DWORD PTR SS:[EBP-1A0]
02CC51D1 53             PUSH EBX
02CC51D2 E8 33090000    CALL 02CC5B0A
02CC51D7 8985 6CFFFFFF MOV DWORD PTR SS:[EBP-94],EAX
02CC51DD 83BD 6CFFFFFF F>CMP DWORD PTR SS:[EBP-94],-1
02CC51E4 0F84 0B000000 JE 02CC51F5
02CC51EA FFB5 6CFFFFFF PUSH DWORD PTR SS:[EBP-94]

02CC51BF处跳转后程序会在目录下生成两个DLL文件。这样就可以进入程序界面了。

重新用OD载入程序，隐藏OD，bp VirtualAlloc，一直F9运行，直到堆栈区如下：

0012DE88 7FF61433  /CALL 到 VirtualAlloc 来自 7FF6142D
0012DE8C 02CC0000  |Address = 02CC0000
0012DE90 000004C8  |Size = 4C8 (1224.)
0012DE94 00001000  |AllocationType = MEM_COMMIT
0012DE98 00000040  \Protect = PAGE_EXECUTE_READWRITE

这时打开内存镜像。

内存镜像，项目 12
地址=00401000/////在这里下内存访问断点。
大小=0001A000 (106496.)
Owner=anota2 00400000
区段=.text
包含=code,imports,resources
类型=Imag 01001004
访问=RW
初始访问=RWE

运行程序后断在：

0040E024 A3 12E04000    MOV DWORD PTR DS:[40E012],EAX////断在这里。
0040E029 68 0BE04000    PUSH anota2.0040E00B                   ; ASCII "TestIt"
0040E02E FF35 12E04000 PUSH DWORD PTR DS:[40E012]
0040E034 E8 29000000    CALL anota2.0040E062
0040E039 A3 16E04000    MOV DWORD PTR DS:[40E016],EAX
0040E03E FF15 16E04000 CALL NEAR DWORD PTR DS:[40E016]////进入!
0040E044 8BD0          MOV EDX,EAX
0040E046 EB 04          JMP SHORT anota2.0040E04C/////跳!
0040E048 0041 40       ADD BYTE PTR DS:[ECX+40],AL
0040E04B 00FF          ADD BH,BH
0040E04D 35 48E04000    XOR EAX,40E048
0040E052 C3             RETN
0040E053 0000          ADD BYTE PTR DS:[EAX],AL

跳到：

0040E04C FF35 48E04000 PUSH DWORD PTR DS:[40E048] ////入口地址!
0040E052 C3             RETN/////返回到入口处。

00404100 55             PUSH EBP ////入口处。
00404101 8BEC          MOV EBP,ESP
00404103 53             PUSH EBX
00404104 56             PUSH ESI
00404105 57             PUSH EDI
00404106 BB 00704000    MOV EBX,anota2.00407000
0040410B 66:2E:F705 8E47>TEST WORD PTR CS:[40478E],4
00404115 0F85 DB000000 JNZ anota2.004041F6
0040411B 6A 00          PUSH 0
0040411D FF15 D0824000 CALL NEAR DWORD PTR DS:[4082D0]
00404123 E8 9C020000    CALL anota2.004043C4
00404128 68 00F04000    PUSH anota2.0040F000
0040412D C3             RETN
0040412E 0100          ADD DWORD PTR DS:[EAX],EAX
00404130 0000          ADD BYTE PTR DS:[EAX],AL

到入口后，看看跳转表：

001541F5  - E9 71C49177    JMP ole32.CoInitialize
001541FA  - E9 28A49077    JMP ole32.CoUninitialize
001541FF  - E9 3C568677    JMP OLEAUT32.SafeArrayCreate
00154204  - E9 47538677    JMP OLEAUT32.SysAllocStringByteLen
00154209  - E9 C2518677    JMP OLEAUT32.SysFreeString
0015420E  - E9 1D538677    JMP OLEAUT32.SysStringByteLen
00154213  - E9 88758677    JMP OLEAUT32.VariantClear
00154218  - E9 F3768677    JMP OLEAUT32.VariantCopy
0015421D  - E9 1FBBDF7F    JMP 7FF4FD41////象这类地址都是被处理过的。
00154222  - E9 CFB4DF7F    JMP 7FF4F6F6
00154227  - E9 321DCA77    JMP USER32.DispatchMessageA
0015422C  - E9 2924CA77    JMP USER32.EnableWindow
00154231  - E9 273CCB77    JMP USER32.EndDialog
00154236  - E9 43EAC977    JMP USER32.GetClientRect
0015423B  - E9 4A16CA77    JMP USER32.GetDlgItem
00154240  - E9 5621CA77    JMP USER32.GetWindowLongA
00154245  - E9 2122CA77    JMP USER32.GetWindowRect
0015424A  - E9 94FFC977    JMP USER32.GetWindowTextA
0015424F  - E9 4039CA77    JMP USER32.GetWindowTextLengthA
00154254  - E9 EB22CC77    JMP USER32.MessageBoxA
00154259  - E9 46C8DF7F    JMP 7FF50AA4
0015425E  - E9 E4F9C977    JMP USER32.SetFocus
00154263  - E9 9124CA77    JMP USER32.SetWindowPos
00154268  - E9 0F00CA77    JMP USER32.SetWindowTextA
0015426D  - E9 9524CA77    JMP USER32.ShowWindow
00154272  - E9 F5D2C977    JMP USER32.TranslateMessage
00154277  - E9 2A13CB77    JMP USER32.DefFrameProcA
0015427C  - E9 731ACB77    JMP USER32.DefMDIChildProcA
00154281  - E9 CAC7DF7F    JMP 7FF50A50
00154286  - E9 E11CCA77    JMP USER32.GetMessageA
0015428B  - E9 8E0BCA77    JMP USER32.GetSystemMetrics
00154290  - E9 1C27CA77    JMP USER32.IsZoomed
00154295  - E9 77BBDF7F    JMP 7FF4FE11
0015429A  - E9 E8BBDF7F    JMP 7FF4FE87
0015429F  - E9 70C0DF7F    JMP 7FF50314
001542A4  - E9 9CBBDF7F    JMP 7FF4FE45
001542A9  - E9 A9BDDF7F    JMP 7FF50057
001542AE  - E9 DE24CA77    JMP USER32.MoveWindow
001542B3  - E9 95B7DF7F    JMP 7FF4FA4D
001542B8  - E9 30B9DF7F    JMP 7FF4FBED
001542BD  - E9 6C7BCB77    JMP USER32.TranslateAcceleratorA
001542C2  - E9 977CCB77    JMP USER32.TranslateMDISysAccel
001542C7  - E9 3BF9C977    JMP USER32.UpdateWindow
001542CC  - E9 BE74CB77    JMP USER32.PostQuitMessage
001542D1  - E9 D0FD5C71    JMP COMCTL32.InitCommonControls
001542D6  - E9 09FC5C71    JMP COMCTL32.ImageList_ReplaceIcon
001542DB  - E9 CFDC5D71    JMP COMCTL32.ImageList_Remove
001542E0  - E9 7C1B5D71    JMP COMCTL32.ImageList_GetIcon
001542E5  - E9 51D25D71    JMP COMCTL32.ImageList_LoadImageA
001542EA  - E9 71C8DF7F    JMP 7FF50B60
001542EF  - E9 1AD25F71    JMP COMCTL32.CreateStatusWindow
001542F4  - E9 C1E09976    JMP COMDLG32.PrintDlgA
001542F9  - E9 AA219A76    JMP COMDLG32.GetOpenFileNameA
001542FE  - E9 22559A76    JMP COMDLG32.GetSaveFileNameA
00154303  - E9 9023E17F    JMP 7FF66698
00154308  - E9 9E24E17F    JMP 7FF667AB

二、查找加密IAT处

下面来找处理IAT的地方。重新用OD载入程序，在上面跳转表地址的随便哪个下硬件写入断点。就可以找到关键处，过程就不说了。不难找到这里：

00415066 57             PUSH EDI
00415067 56             PUSH ESI
00415068 8BCD          MOV ECX,EBP
0041506A 81C1 65664200 ADD ECX,426665
00415070 8D39          LEA EDI,DWORD PTR DS:[ECX]
00415072 3E:8B77 04    MOV ESI,DWORD PTR DS:[EDI+4]
00415076 8932          MOV DWORD PTR DS:[EDX],ESI
00415078 2BC6          SUB EAX,ESI
0041507A 83E8 05       SUB EAX,5
0041507D C606 E9       MOV BYTE PTR DS:[ESI],0E9/////移入JMP指令。
00415080 8946 01       MOV DWORD PTR DS:[ESI+1],EAX/////函数地址移入。
00415083 3E:8347 04 05 ADD DWORD PTR DS:[EDI+4],5
00415088 5E             POP ESI
00415089 5F             POP EDI
0041508A 59             POP ECX
0041508B 83C1 04       ADD ECX,4
0041508E 83C2 04       ADD EDX,4
00415091  ^ E9 09FFFFFF    JMP anota2.00414F9F
00415096 83C6 0C       ADD ESI,0C
00415099  ^ E9 6BFEFFFF    JMP anota2.00414F09
0041509E 33C0          XOR EAX,EAX
004150A0 40             INC EAX

上面的EAX的值是从哪里来的？跟踪可以发现：

00414F48 53             PUSH EBX
00414F49 8BD5          MOV EDX,EBP
00414F4B 81C2 423E4200 ADD EDX,423E42
00414F51 FF12          CALL NEAR DWORD PTR DS:[EDX]/////这里就是给EAX赋值的CALL，进入。
00414F53 85C0          TEST EAX,EAX
00414F55 0F84 46010000 JE anota2.004150A1
00414F5B 52             PUSH EDX
00414F5C 50             PUSH EAX
00414F5D 8BD5          MOV EDX,EBP
00414F5F 81C2 3D654200 ADD EDX,42653D
00414F65 F702 04000000 TEST DWORD PTR DS:[EDX],4
00414F6B 74 12          JE SHORT anota2.00414F7F
00414F6D 8BD5          MOV EDX,EBP
00414F6F 81C2 B55B4200 ADD EDX,425BB5

进入后，跟踪来到：

7FF667CA 8365 E4 00    AND DWORD PTR SS:[EBP-1C],0
7FF667CE 6A 00          PUSH 0
7FF667D0 8D45 EC       LEA EAX,DWORD PTR SS:[EBP-14]
7FF667D3 50             PUSH EAX
7FF667D4 FF75 08       PUSH DWORD PTR SS:[EBP+8]
7FF667D7 E8 8B92FFFF    CALL 7FF5FA67
7FF667DC 83C4 0C       ADD ESP,0C
7FF667DF 0FB6C0       MOVZX EAX,AL
7FF667E2 85C0          TEST EAX,EAX
7FF667E4 74 48          JE SHORT 7FF6682E/////强制跳转!
7FF667E6 6A 01          PUSH 1
7FF667E8 6A 00          PUSH 0
7FF667EA FF75 0C       PUSH DWORD PTR SS:[EBP+C]
7FF667ED 68 1065F87F    PUSH 7FF86510                         ; ASCII "GetProcAddress"
7FF667F2 8B4D EC       MOV ECX,DWORD PTR SS:[EBP-14]
7FF667F5 E8 7028FEFF    CALL 7FF4906A
7FF667FA 8945 E4       MOV DWORD PTR SS:[EBP-1C],EAX
7FF667FD 837D E4 00    CMP DWORD PTR SS:[EBP-1C],0
7FF66801 75 1B          JNZ SHORT 7FF6681E

上面7FF667E4强制跳转后，就不会破坏IAT了。不过程序会检测到代码被修改，然后产生异常。但不要紧，这里IAT已经完整了，用ImportREC可以找到全部IAT。如下：

; Syntax for each function in a thunk (the separator is a TAB)
; ------------------------------------------------------------
; Flag RVA ModuleName Ordinal Name
;
; Details for <有效 > parameter:
; ------------------------------
; Flag:  0 = valid: no  -> - Name contains the address of the redirected API (you can set
;                         it to zero if you edit it).
;                         - Ordinal is not considered but you should let '0000' as value.
;                         - ModuleName is not considered but you should let '?' as value.
;
;       1 = valid: yes -> All next parameters on the line will be considered.
;                         Function imported by ordinal must have no name (the 4th TAB must
;                                                                         be there though).
;
;       2 = Equivalent to 0 but it is for the loader.
;
;       3 = Equivalent to 1 but it is for the loader.
;
;       4 = Equivalent to 0 with (R) tag.
;
;       5 = Equivalent to 1 with (R) tag.
;
; 决定在于你 , 编辑这个文件需要承担风险 !    :-)

目标  : C:\Documents and Settings\Administrator\桌面\anota2.rar_620\anota2.exe
OEP: 00004100  IATRVA: 00008234  IAT大小: 00000188

FThunk: 00008238  NbFunc: 00000002
1  00008238  advapi32.dll  01A5  RegOpenKeyExA
1  0000823C  advapi32.dll  018C  RegCloseKey

FThunk: 00008244  NbFunc: 00000001
1  00008244  gdi32.dll  0168  GetStockObject

FThunk: 0000824C  NbFunc: 00000020
1  0000824C  kernel32.dll  001F  CloseHandle
1  00008250  kernel32.dll  0039  CreateFileA
1  00008254  kernel32.dll  0091  ExitProcess
1  00008258  kernel32.dll  00BE  FlushFileBuffers
1  0000825C  kernel32.dll  00C6  FreeEnvironmentStringsA
1  00008260  kernel32.dll  00DF  GetCommandLineA
1  00008264  kernel32.dll  010C  GetCurrentDirectoryA
1  00008268  kernel32.dll  011E  GetEnvironmentStrings
1  0000826C  kernel32.dll  012A  GetFileSize
1  00008270  kernel32.dll  012D  GetFileType
1  00008274  kernel32.dll  0132  GetLastError
1  00008278  kernel32.dll  013F  GetModuleHandleA
1  0000827C  kernel32.dll  016B  GetStartupInfoA
1  00008280  kernel32.dll  0177  GetSystemInfo
1  00008284  kernel32.dll  0194  GetVersionExA
1  00008288  kernel32.dll  01A1  GlobalAlloc
1  0000828C  kernel32.dll  01A8  GlobalFree
1  00008290  kernel32.dll  0209  MultiByteToWideChar
1  00008294  kernel32.dll  0244  ReadFile
1  00008298  kernel32.dll  028F  SetCurrentDirectoryA
1  0000829C  kernel32.dll  0293  SetEndOfFile
1  000082A0  kernel32.dll  0296  SetErrorMode
1  000082A4  kernel32.dll  029C  SetFilePointer
1  000082A8  kernel32.dll  02A3  SetLastError
1  000082AC  kernel32.dll  02CA  Sleep
1  000082B0  kernel32.dll  02D7  TlsAlloc
1  000082B4  kernel32.dll  02D8  TlsFree
1  000082B8  kernel32.dll  02D9  TlsGetValue
1  000082BC  kernel32.dll  02DA  TlsSetValue
1  000082C0  kernel32.dll  0308  WideCharToMultiByte
1  000082C4  kernel32.dll  0315  WriteFile
1  000082C8  kernel32.dll  0193  GetVersion

FThunk: 000082D0  NbFunc: 00000002
1  000082D0  ole32.dll  003C  CoInitialize
1  000082D4  ole32.dll  0064  CoUninitialize

FThunk: 000082DC  NbFunc: 00000006
1  000082DC  oleaut32.dll  000F  SafeArrayCreate
1  000082E0  oleaut32.dll  0096  SysAllocStringByteLen
1  000082E4  oleaut32.dll  0006  SysFreeString
1  000082E8  oleaut32.dll  0095  SysStringByteLen
1  000082EC  oleaut32.dll  0009  VariantClear
1  000082F0  oleaut32.dll  000A  VariantCopy

FThunk: 000082F8  NbFunc: 00000024
1  000082F8  user32.dll  0051  CreateDialogParamA
1  000082FC  user32.dll  005B  CreateWindowExA
1  00008300  user32.dll  0098  DispatchMessageA
1  00008304  user32.dll  00BA  EnableWindow
1  00008308  user32.dll  00BC  EndDialog
1  0000830C  user32.dll  00F4  GetClientRect
1  00008310  user32.dll  0106  GetDlgItem
1  00008314  user32.dll  015B  GetWindowLongA
1  00008318  user32.dll  0161  GetWindowRect
1  0000831C  user32.dll  0163  GetWindowTextA
1  00008320  user32.dll  0164  GetWindowTextLengthA
1  00008324  user32.dll  01C4  MessageBoxA
1  00008328  user32.dll  0219  SendMessageA
1  0000832C  user32.dll  0234  SetFocus
1  00008330  user32.dll  0261  SetWindowPos
1  00008334  user32.dll  0264  SetWindowTextA
1  00008338  user32.dll  0270  ShowWindow
1  0000833C  user32.dll  0288  TranslateMessage
1  00008340  user32.dll  0083  DefFrameProcA
1  00008344  user32.dll  0085  DefMDIChildProcA
1  00008348  user32.dll  0096  DialogBoxParamA
1  0000834C  user32.dll  012E  GetMessageA
1  00008350  user32.dll  014A  GetSystemMetrics
1  00008354  user32.dll  0198  IsZoomed
1  00008358  user32.dll  019B  LoadAcceleratorsA
1  0000835C  user32.dll  019F  LoadCursorA
1  00008360  user32.dll  01A3  LoadIconA
1  00008364  user32.dll  01AB  LoadMenuA
1  00008368  user32.dll  01B0  LoadStringA
1  0000836C  user32.dll  01CF  MoveWindow
1  00008370  user32.dll  01F7  RegisterClassA
1  00008374  user32.dll  01F8  RegisterClassExA
1  00008378  user32.dll  0284  TranslateAccelerator
1  0000837C  user32.dll  0287  TranslateMDISysAccel
1  00008380  user32.dll  0297  UpdateWindow
1  00008384  user32.dll  01E6  PostQuitMessage

FThunk: 0000838C  NbFunc: 00000007
1  0000838C  comctl32.dll  0011  InitCommonControls
1  00008390  comctl32.dll  0046  ImageList_ReplaceIcon
1  00008394  comctl32.dll  0044  ImageList_Remove
1  00008398  comctl32.dll  003A  ImageList_GetIcon
1  0000839C  comctl32.dll  003F  ImageList_LoadImage
1  000083A0  comctl32.dll  0016  CreateToolbarEx
1  000083A4  comctl32.dll  0006  CreateStatusWindowA

FThunk: 000083AC  NbFunc: 00000003
1  000083AC  comdlg32.dll  0075  PrintDlgA
1  000083B0  comdlg32.dll  006E  GetOpenFileNameA
1  000083B4  comdlg32.dll  0070  GetSaveFileNameA

三、修复主程序

修复很简单。到入口后：

00404100 55             PUSH EBP                               ; anota2.00413E4A
00404101 8BEC          MOV EBP,ESP
00404103 53             PUSH EBX
00404104 56             PUSH ESI
00404105 57             PUSH EDI
00404106 BB 00704000    MOV EBX,anota2.00407000
0040410B 66:2E:F705 8E47>TEST WORD PTR CS:[40478E],4
00404115 0F85 DB000000 JNZ anota2.004041F6
0040411B 6A 00          PUSH 0
0040411D FF15 D0824000 CALL NEAR DWORD PTR DS:[4082D0]
00404123 E8 9C020000    CALL anota2.004043C4
00404128 68 00F04000    PUSH anota2.0040F000////修复处1。
0040412D C3             RETN
0040412E 0100          ADD DWORD PTR DS:[EAX],EAX
00404130 0000          ADD BYTE PTR DS:[EAX],AL
00404132 8D83 94020000 LEA EAX,DWORD PTR DS:[EBX+294]
00404138 50             PUSH EAX
00404139 FF15 84824000 CALL NEAR DWORD PTR DS:[408284]
0040413F 83EC 44       SUB ESP,44
00404142 C70424 44000000 MOV DWORD PTR SS:[ESP],44
00404149 C74424 2C 00000>MOV DWORD PTR SS:[ESP+2C],0
00404151 54             PUSH ESP
00404152 FF15 7C824000 CALL NEAR DWORD PTR DS:[40827C]
00404158 B8 0A000000    MOV EAX,0A
0040415D F74424 2C 01000>TEST DWORD PTR SS:[ESP+2C],1
00404165 74 05          JE SHORT anota2.0040416C
00404167 0FB74424 30    MOVZX EAX,WORD PTR SS:[ESP+30]
0040416C 83C4 44       ADD ESP,44
0040416F 8983 FE000000 MOV DWORD PTR DS:[EBX+FE],EAX
00404175 FF15 60824000 CALL NEAR DWORD PTR DS:[408260]
0040417B E8 21040000    CALL anota2.004045A1
00404180 8983 F4000000 MOV DWORD PTR DS:[EBX+F4],EAX
00404186 FF15 68824000 CALL NEAR DWORD PTR DS:[408268]
0040418C 8983 F0000000 MOV DWORD PTR DS:[EBX+F0],EAX
00404192 6A 00          PUSH 0
00404194 FF15 78824000 CALL NEAR DWORD PTR DS:[408278]
0040419A 8983 04010000 MOV DWORD PTR DS:[EBX+104],EAX
004041A0 E8 07010000    CALL anota2.004042AC
004041A5 68 00004100    PUSH anota2.00410000////修复处2。
004041AA C3             RETN
004041AB 36:E8 5E020000  CALL anota2.0040440F                   ; 多余的前缀
004041B1 E8 3B040000    CALL anota2.004045F1
004041B6 68 00104100    PUSH anota2.00411000////修复处3。
004041BB C3             RETN
004041BC 07             POP ES                                  ; 修正的段位寄存器
004041BD 53             PUSH EBX
004041BE E8 57010000    CALL anota2.0040431A
004041C3 5B             POP EBX
004041C4 50             PUSH EAX
004041C5 E8 55010000    CALL anota2.0040431F
004041CA E8 37010000    CALL anota2.00404306
004041CF 68 00204100    PUSH anota2.00412000////修复处4。
004041D4 C3             RETN
004041D5 FF15 5C824000 CALL NEAR DWORD PTR DS:[40825C]
004041DB FF4B 1C       DEC DWORD PTR DS:[EBX+1C]

共有4处要修复。其中第4处是程序退出时运行的。004041D5处下断，运行程序，然后退出程序。程序就会断在004041D5处。此时要修复的代码都已解开：
00404100 55             PUSH EBP
00404101 8BEC          MOV EBP,ESP
00404103 53             PUSH EBX
00404104 56             PUSH ESI
00404105 57             PUSH EDI
00404106 BB 00704000    MOV EBX,anota2.00407000
0040410B 66:2E:F705 8E47>TEST WORD PTR CS:[40478E],4
00404115 0F85 DB000000 JNZ anota2.004041F6
0040411B 6A 00          PUSH 0
0040411D FF15 D0824000 CALL NEAR DWORD PTR DS:[4082D0]
00404123 E8 9C020000    CALL anota2.004043C4
00404128 C783 08010000 0>MOV DWORD PTR DS:[EBX+108],1////已修复处1
00404132 8D83 94020000 LEA EAX,DWORD PTR DS:[EBX+294]
00404138 50             PUSH EAX
00404139 FF15 84824000 CALL NEAR DWORD PTR DS:[408284]
0040413F 83EC 44       SUB ESP,44
00404142 C70424 44000000 MOV DWORD PTR SS:[ESP],44
00404149 C74424 2C 00000>MOV DWORD PTR SS:[ESP+2C],0
00404151 54             PUSH ESP
00404152 FF15 7C824000 CALL NEAR DWORD PTR DS:[40827C]
00404158 B8 0A000000    MOV EAX,0A
0040415D F74424 2C 01000>TEST DWORD PTR SS:[ESP+2C],1
00404165 74 05          JE SHORT anota2.0040416C
00404167 0FB74424 30    MOVZX EAX,WORD PTR SS:[ESP+30]
0040416C 83C4 44       ADD ESP,44
0040416F 8983 FE000000 MOV DWORD PTR DS:[EBX+FE],EAX
00404175 FF15 60824000 CALL NEAR DWORD PTR DS:[408260]
0040417B E8 21040000    CALL anota2.004045A1
00404180 8983 F4000000 MOV DWORD PTR DS:[EBX+F4],EAX
00404186 FF15 68824000 CALL NEAR DWORD PTR DS:[408268]
0040418C 8983 F0000000 MOV DWORD PTR DS:[EBX+F0],EAX
00404192 6A 00          PUSH 0
00404194 FF15 78824000 CALL NEAR DWORD PTR DS:[408278]
0040419A 8983 04010000 MOV DWORD PTR DS:[EBX+104],EAX
004041A0 E8 07010000    CALL anota2.004042AC
004041A5 B8 FF000000    MOV EAX,0FF////已修复处2
004041AA 72 36          JB SHORT anota2.004041E2
004041AC E8 5E020000    CALL anota2.0040440F
004041B1 E8 3B040000    CALL anota2.004045F1
004041B6 B8 FF000000    MOV EAX,0FF////已修复处3
004041BB 72 07          JB SHORT anota2.004041C4
004041BD 53             PUSH EBX
004041BE E8 57010000    CALL anota2.0040431A
004041C3 5B             POP EBX
004041C4 50             PUSH EAX
004041C5 E8 55010000    CALL anota2.0040431F
004041CA E8 37010000    CALL anota2.00404306
004041CF FFB3 F0000000 PUSH DWORD PTR DS:[EBX+F0]////已修复处4
004041D5 FF15 5C824000 CALL NEAR DWORD PTR DS:[40825C]

把这些代码复制后覆盖到主程序404100－4041D4处就完成了。

登录后可查看完整内容

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课

收藏・2

免费・7

支持

最新回复 (3)
Lenus 雪币： 159 活跃值： (339) 能力值： ( LV8，RANK：130 ) 在线值：发帖 17 回帖 394 粉丝 22 关注私信	Lenus 3 2 楼厉害，支持！ 2004-12-13 13:00 0
wzmooo 雪币： 10619 活跃值： (2314) 能力值： ( LV2，RANK：10 ) 在线值：发帖 8 回帖 497 粉丝 1 关注私信	wzmooo 3 楼呵呵不错。 2004-12-13 16:03 0
linhanshi 雪币： 97697 活跃值： (200824) 能力值： (RANK：10 ) 在线值：发帖 9249 回帖 27947 粉丝 452 关注私信	linhanshi 4 楼支持!!! 2004-12-13 22:52 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

csjwaman

发帖

883

回帖

980

RANK

关注

私信

他的文章

关于我们

联系我们

企业服务

看雪公众号

最新回复 (3)
Lenus 雪币： 159 活跃值： (339) 能力值： ( LV8，RANK：130 ) 在线值：发帖 17 回帖 394 粉丝 22 关注私信	Lenus 3 2 楼厉害，支持！ 2004-12-13 13:00 0
wzmooo 雪币： 10619 活跃值： (2314) 能力值： ( LV2，RANK：10 ) 在线值：发帖 8 回帖 497 粉丝 1 关注私信	wzmooo 3 楼呵呵不错。 2004-12-13 16:03 0
linhanshi 雪币： 97697 活跃值： (200824) 能力值： (RANK：10 ) 在线值：发帖 9249 回帖 27947 粉丝 452 关注私信	linhanshi 4 楼支持!!! 2004-12-13 22:52 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复